chore(deps): clear the qs moderate advisories and refresh patch-level pins - #6054
Merged
atomantic merged 1 commit intoSep 3, 2026
Merged
Conversation
… pins `npm audit` was red in server/ and autofixer/: the `qs` override sat at 6.15.3, which is the top of the vulnerable range for GHSA-x5fp-wj9c-mxmx (array-limit bypass via bracket-key comma parsing) and GHSA-4mjr-xmp4-gh2g (DoS via attacker-controlled isBuffer). 6.16.0 is the first fixed release, and both express and googleapis-common resolve through it. All four workspaces now audit clean. Alongside that, the routine currency pass: - server: undici 8.10.0 -> 8.10.1, postcss override 8.5.26 -> 8.5.27, ip-address override 10.5.0 -> 10.7.0 (root override matched) - client: @biomejs/biome 2.5.11 -> 2.5.12, @testing-library/user-event 14.6.6 -> 14.6.7, lucide-react 1.37.0 -> 1.40.0 - client also gains the postcss pin, because dependency-overrides.test.js requires every tracked lockfile to resolve a pinned package to the pin -- bumping it in server/ alone left client's tree drifting at 8.5.26. Left alone deliberately: the js-yaml (4->5), protobufjs (7->8) and nanoid (3->6) overrides all have newer majors, but each is a security *floor* on a transitive dependency whose consumer still asks for the old major, so forcing the major would break the consumer for no audit benefit. node-pty and jsdom are intentionally pinned ahead of their `latest` dist-tags.
atomantic
deleted the
cos/sys-portos-d-dependency-updates-mtld0om6/agent-2a22166f
branch
September 3, 2026 10:21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
qsoverride sat at6.15.3, the top of the vulnerable range for GHSA-x5fp-wj9c-mxmx (array-limit bypass via bracket-key comma parsing) and GHSA-4mjr-xmp4-gh2g (DoS via attacker-controlledisBuffer). Bumped to6.16.0, the first fixed release, inserver/andautofixer/.npm auditnow reports 0 vulnerabilities in all four workspaces (it was 4 moderate inserver/, 3 inautofixer/).undici8.10.0 → 8.10.1,postcssoverride 8.5.26 → 8.5.27,ip-addressoverride 10.5.0 → 10.7.0 (root + server kept in parity),@biomejs/biome2.5.11 → 2.5.12,@testing-library/user-event14.6.6 → 14.6.7,lucide-react1.37.0 → 1.40.0.client/also gains thepostcsspin:dependency-overrides.test.jsrequires every tracked lockfile to resolve a pinned package to its pin, so bumping it inserver/alone left client's tree drifting at 8.5.26.No open Dependabot/Renovate PRs to land first — all five open PRs are human-authored, and
.github/dependabot.ymlalready covers all four npm directories.Deliberately left alone
js-yaml(4→5),protobufjs(7→8),nanoid(3→6) — each override is a security floor on a transitive dependency whose consumer still asks for the old major. Forcing the major would break the consumer for no audit benefit; none of the current pins is vulnerable.node-pty(1.2.0-beta.15) andjsdom(30.0.1) are intentionally pinned ahead of theirlatestdist-tags.Test plan
npm auditacross root,server/,client/,autofixer/— 0 vulnerabilities each (was 4 + 3 moderate).cd server && npm test— 38301 passed, 1 skipped.cd client && npm test— 10145 passed, 1 skipped.cd client && npm run buildandnpm run lint(biome 2.5.12) — both clean.npm run smoke— server survived the boot window and shut down gracefully.